Which of the following is a core principle of internal controls?

• A. Segregation of duties
• B. Log-only access control
• C. Annual randomization of approvals
• D. No documentation requirements

Answer: (A)

Internal controls rely on separation of duties to prevent fraud and errors by dividing responsibilities among different people. When different individuals handle authorization, custody of assets, and recording of transactions, there are built‑in checks and balances. This makes it much harder for someone to both commit and conceal a misdeed, because another person is required to review or approve at a different stage. For example, the person approving expenditures shouldn’t be the one who handles the cash or maintains the ledger, and someone who maintains records shouldn’t be the sole person with authority to authorize payments.

Log‑only access control doesn’t provide this separation, so a single person could still perform incompatible duties without others detecting it. Annual randomization of approvals isn’t a reliable, standard practice and can disrupt consistent processes and accountability. No documentation requirements remove the essential trail that allows verification and correction if issues arise. Continuous, well-documented separation of duties is what makes internal controls effective at reducing risk.